SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting

  Why it's wrong here

  Cross-site scripting (XSS) injects client-side script code, such as JavaScript, that executes in a victim's browser after being reflected from or stored by the web application. The submitted payload `' OR 1=1` is pure SQL operator syntax; it is not wrapped in `<script>` tags nor interpreted by the browser's JavaScript engine. XSS could steal session cookies or modify page content, but it cannot change the semantics of the backend SQL query that validates the login credentials. Therefore, this login bypass is the result of SQL injection, not XSS.

• ✓

  SQL injection

  Why this is correct

  SQL injection occurs when user input is concatenated into an SQL statement without proper parameterization, allowing the database to interpret part of that input as SQL syntax. In a login query like `SELECT * FROM users WHERE username = '$user' AND password = '$pass'`, entering `' OR 1=1 --` in the username field closes the string, injects an always-true condition, and comments out the password check. This makes the `WHERE` clause evaluate to true for at least one row, so the database returns a valid user record and the application grants authenticated access. Because the attacker directly altered the query's logic rather than executing browser code or reusing a token, this is a textbook SQL authentication bypass.

• ✗

  Session hijacking

  Why it's wrong here

  Session hijacking is an attack on the post-authentication state, where the attacker obtains, predicts, or replays a valid session identifier (such as a cookie or URL token) to impersonate an authenticated user. It requires an existing session to be active or a predictable token generation mechanism to exploit. The tester's input `' OR 1=1` is submitted to the login form before any session exists; it is not stealing or manipulating a session token, and it does not affect how the application manages session state. The access gained is by tricking the database's authentication query, not by hijacking a session, making this option incorrect.

• ✗

  Insecure deserialization

  Why it's wrong here

  Insecure deserialization arises when an application deserializes untrusted, attacker-controlled data (for example, PHP object or Java serialized streams) without proper validation, which can lead to object injection, property manipulation, or remote code execution. This attack vector typically involves crafted binary or serialized content in cookies, hidden form fields, or API payloads, not a short string of SQL arithmetic/operators typed into a login field. The payload `' OR 1=1` is SQL syntax that targets the database query layer; it is not a serialized object and would not be processed by any deserialization routine. Therefore, it cannot cause insecure deserialization; the observed outcome is a database query logic bypass.

Go deeper

Related to this question